security: give the searx bridge its own gate key

RESPIRE_SPACE_KEY guards the audio and inference routes; the searx
bridge now checks SEARX_API_KEY instead, so search access can be
rotated without touching the audio path. Both fail closed when unset.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

app.py

@@ -902,21 +902,29 @@ def _patched_create_app(blocks, **kwargs):
         import hmac as _hmac
 
         _SPACE_KEY = os.environ.get("RESpite_SPACE_KEY", "")
+        # Which secret guards which prefix. The searx bridge gets its own key
+        # (SEARX_API_KEY) so rotating search access never touches the audio
+        # path; everything else shares RESPIRE_SPACE_KEY.
         _PROTECTED_PREFIXES = (
             "/respite/audio/",
             "/respite/search",
             "/respite/text/",
             "/respite/benchmark",
             # The searx bridge (searx_bridge.py) mounts under /respite/v2/ —
-            # same compute, same key. Without this it is an open proxy: anyone
-            # on the internet can run searches on the Space's IP for free.
+            # without a gate it is an open proxy: anyone on the internet can
+            # run searches on the Space's IP for free.
             "/respite/v2/searx/",
         )
 
+        def _expected_key(path: str) -> str:
+            if path.startswith("/respite/v2/searx/"):
+                return os.environ.get("SEARX_API_KEY", "")
+            return os.environ.get("RESPIRE_SPACE_KEY", "")
+
         @fa_app.middleware("http")
         async def _respite_key_gate(request, call_next):
             if request.url.path.startswith(_PROTECTED_PREFIXES):
-                _SPACE_KEY = os.environ.get("RESPIRE_SPACE_KEY", "")
+                _SPACE_KEY = _expected_key(request.url.path)
                 if not _SPACE_KEY:
                     return JSONResponse(
                         {"error": "service not configured"}, status_code=503